Alertas de Seguridad de la Información

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46320] In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths i…

In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value an…

nvdaltovulnerabilidad CVSS 7.4 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46321] In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame r…

In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each s…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46322] In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb fai…

In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46323] In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skb…

In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to anoth…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46324] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use list_…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use list_del_rcu for netlink hooks nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers. Add a new helper and use it consistently.

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11681] Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker …

Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11682] Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a re…

Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11644] Use after free in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed an attacker who co…

Use after free in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46311] In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address. (cherry picked from commit 1fc6c8ab45dbee096469c0…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46304] In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq…

In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work on the same nvmet-wq. Call chain: nvmet_tcp_schedule_release_queue() …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46306] In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect …

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow dissector driver has assumed an uncompressed frame until the blamed commit. During the review process o…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46307] In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access arra…

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: >

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46308] In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-aft…

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The function then calls of_node_put(node) before checking whether syscon_regmap_lookup_by_phandle() returns an error. If an e…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46309] In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PA…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. Using coh_none with CPU cached buffers is a security issue. When the kernel clears pages before reallocation, the clear operatio…

nvdaltovulnerabilidad CVSS 7.0 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46299] In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on…

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key() fails, the function jumps to the out_put_root error label without releasing the lock. The later cleanup path then free…

nvdaltovulnerabilidad CVSS 7.0 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46301] In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-afte…

In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-after-free on unbind Give the driver a chance to flush its queue before releasing the DMA buffers on driver unbind

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46303] In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE c…

In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added c…

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46293] In the Linux kernel, the following vulnerability has been resolved: clk: microchip: mpfs-ccc: fix o…

In the Linux kernel, the following vulnerability has been resolved: clk: microchip: mpfs-ccc: fix out of bounds access during output registration UBSAN reported an out of bounds access during registration of the last two outputs. This out of bounds access occurs because space is only allocated in the hws array for two PLLs and the four output dividers that each has, but the defined IDs contain t…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46294] In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in io…

In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46285] In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free …

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3_release() In docg3_release(), the docg3 pointer is obtained from cascade->floors[0]->priv before the loop that calls doc_release_device() on each floor. doc_release_device() frees the docg3 struct via kfree(docg3) at line 1881. After the loop, docg3->cascade->bch dereferences the already-f…

nvdaltovulnerabilidad CVSS 7.8 NVD